Running your application
Firewall
A rate limit per visitor and bot control in front of an environment, with bunny.net Shield on its pull zone.
On this page
An environment with bunny.net in front of it can have a firewall: bunny.net Shield on its pull zone. You ask for it under firewall in brewless.yml, and the next deploy sets it up.
environments:
production:
firewall:
rate_limit: 100
bot_control: challenge
Rate limit
rate_limit is how many requests one address may make in 10 seconds. An address that makes more is blocked by bunny.net for a minute; the requests of everybody else go on. The count is per address and covers every path of the environment.
Ten seconds is the longest window of Shield Basic, the plan bunny.net gives for free. Choose a number well above what a real visitor does in ten seconds: a page with its scripts, styles and images can take dozens of requests.
Brewless keeps one rate limit rule of its own on the Shield zone, called BrewlessRateLimit. A deploy makes it, changes its number when the file changes it, and removes it for rate_limit: false. Rules you made yourself in the bunny.net dashboard are never touched. Shield Basic takes two rate limit rules, so one is left for your own.
Bot control
bot_control says what Shield does with a visitor that looks like a bot:
| Value | What happens |
|---|---|
challenge |
The visitor gets a challenge from bunny.net before the request goes on. |
log |
Nothing is blocked; bunny.net only records what it found. |
off |
Bot detection is switched off. |
Warning
Bot control is not part of Shield Basic. It takes Shield Advanced or higher, and those plans cost money at bunny.net: Advanced starts at $9.50 a month per pull zone. bunny.net bills that to your own bunny.net account; it is not part of what Brewless charges. Brewless never changes the plan of a Shield zone. Choose the plan in your bunny.net dashboard, under Shield, and deploy again.
On Shield Basic a deploy leaves bot control as it is and says so in a warning; the release itself goes live. brewless plan says it next to the line.
The Shield zone
The first deploy that asks for a rate limit or for bot control makes a Shield zone for the pull zone, on Shield Basic. A pull zone that has a Shield zone already keeps it, with its plan. A new Shield zone starts in bunny.net's learning mode for seven days: its web application firewall only records what it would block, while a rate limit blocks at once.
firewall: false takes away what Brewless set: its rate limit rule goes, and bot control is switched off. The Shield zone itself stays; bunny.net offers no way to remove one. Leaving firewall out of the file, or one of its settings, leaves that part as it is at bunny.net.
A firewall needs bunny.net in front of the environment. Without a pull zone a deploy sets nothing and says why in a warning. When bunny.net refuses a setting, the release is live anyway and the deploy says so.
Every change Brewless makes to the Shield zone is written to the audit trail.